Twenty-five to 30 tax filers have contacted the S.C. Department of Revenue, believing they are victims of identity theft as a result of the hacking of the agency last year.
That number is likely to grow as more South Carolinians file their taxes.
"Many more people could be affected. They just don't know it yet, except for the early filers," said Paul Stephens of Privacy Rights, a California-based nonprofit that advocates for consumers' rights and privacy. "Many people are just starting to think about taxes."
One Savannah man who works in South Carolina thinks he's an identity-theft victim. He received a letter Feb. 22 from the IRS, alerting him that the federal agency had received a tax return bearing his name and was reviewing the information in the return.
"I hadn't filed my taxes yet, so it was a big surprise," he said, adding the letter came addressed to himself and a second person he did not know. "(The hacking) is the only place my Social Security could have come from."
He's since had to submit copies of his driver's license, Social Security card and other information to the IRS to clear up the problem.
Social Security numbers, bank account information and other records for 3.8 million taxpayers were compromised after an international hacker infiltrated the S.C. agency's computer system through an unsophisticated method that probably started with a malicious email, according to a cyber security expert hired by the state. It is the biggest cyber attack against a state government, experts say, and could lead to bogus tax returns being filed at both the federal and state level.
Options are limited for those whose information has been stolen, but the best advice is to file tax returns now, Stephens said.
"File as early as possible. The name of the game is beating the fraudster to filing," said Stephens, because that will mean tax filers will get their returns before scammers submit phony returns. And for those who are not owed a return, it increases the odds federal and state tax agencies will pick up on the fraud.
Filing bogus tax returns is one of the fastest-growing types of identity theft, Stephens said, exacerbated this year because of a federal law to resolve the fiscal-cliff crisis that delayed the start of the tax-filing season.
"The delay has given the fraudsters a chance to jump in and file before the actual taxpayer has an opportunity to do so," Stephens said.
S.C. Department of Revenue officials said they're offering help to anyone who thinks they are identity-theft victims.
"We are keeping detailed records of these types of reports and are assisting those individuals through our Data Breach Assistance Team in any way that we can," said Samantha Cheek, agency spokeswoman, referring to a team set up by Gov. Nikki Haley's office and the agency to assist victims of the breach.
The 25 to 30 people who have contacted the agency have done so for a range of identity theft-related reasons, including inquiries on their credit reports and bank accounts and for bogus tax returns, she said. It is unclear if the hacking is the cause, she said.
So far this year, the state has not seen an increase in the number of fraudulent state refunds.
"With the implementation of the new security program, we hope to stop additional fraudulent refunds from being issued this year," she said.
For those who think someone might have submitted a bogus tax return in their name, the Department of Revenue urges them to call and get help. That includes help setting up a fraud alert and a security freeze on their credit with the three credit bureaus, and submitting a complaint to the Federal Trade Commission and their local police. They'll also get advice on contacting their banks if there are fraudulent charges on their bank account.
Mark Green, spokesman for the S.C. office of the Internal Revenue Service, said he cannot comment on identity theft related to the hacking because of federal disclosure laws. But so far, he said, he has not heard of identity-theft cases related to the hacking.